Spring 2016 CS 155 Mobile Platform Security Models

Spring 2016 CS 155 Mobile Platform Security Models John Mitchell

Outline Introduction n Platforms App market Threats Android security model Apple i. OS security model Windows 7, 8 Mobile security model 2

Change takes time i. Phone, 2007 Apple Newton, 1987 Palm Pilot, 1997 3

Global smartphone market share 4

5

US Mobile App Traffic 6 http: //www. ironpaper. com/webintel/articles/web-design-statistics-2015/

Zillions of apps 7

App Marketplace App review before distribution n n i. OS: Apple manual and automated vetting Android w Easier to get app placed on market w Transparent automated scanning, removal via Bouncer App isolation and protection n n Sandboxing and restricted permission Android w Permission model w Defense against circumvention 8

Threats to mobile applications Privacy n Data leakage, identifier leakage, third-party tags and libraries, location privacy Security n 9 Phishing, malware & drive-bys, malicious intents on Android, Ikee/Zitmo and other mobile malware

OWASP Mobile Top Ten M 1: Improper Platform Usage M 2: Insecure Data M 3: Insecure Communication M 4: Insecure Authentication M 5: Insufficient Cryptography M 6: Insecure Authorization M 7: Client Code Quality Issues M 8: Code Tampering M 9: Reverse Engineering M 10: Extraneous Functionality 10 https: //www. owasp. org/index. php/Projects/OWASP_Mobile_Security_Project_-2015_Scratchpad

Mobile malware examples Droid. Dream (Android) n n Over 58 apps uploaded to Google app market Conducts data theft; send credentials to attackers Ikee (i. OS) n n Worm capabilities (targeted default ssh pwd) Worked only on jailbroken phones with ssh installed Zitmo (Symbian, Black. Berry, Windows, Android) n n n 11 Propagates via SMS; claims to install a “security certificate” Captures info from SMS; aimed at defeating 2 -factor auth Works with Zeus botnet; timed with user PC infection

Sample FTC concerns FTC To Study Mobile Device Industry’s Security Update Practices (May 9, 2016) Federal Court Finds Amazon Liable for Billing Parents for Children’s Unauthorized In-App Charges (April 27, 2016) Tech Company Settles FTC Charges It Unfairly Installed Apps on Android Mobile Devices Without Users’ Permission (February 5, 2016) Defendants in Massive Spam Text Message, Robocalling and Mobile Cramming Scheme to Pay $10 Million to Settle FTC Charges (October 22, 2014) Snapchat Settles FTC Charges That Promises of Disappearing Messages Were False (May 8, 2014) 12 https: //www. ftc. gov/news-events/media-resources/mobile-technology

Outline Introduction n Platforms App market Threats Android security model Apple i. OS security model Windows 7, 8 Mobile security model 14

Android Platform outline: n n Linux kernel, browser, SQL-lite database Software for secure network communication w Open SSL, Bouncy Castle crypto API and Java library n n C language infrastructure Java platform for running applications w Dalvik bytecode, virtual machine 15

16

Android market Self-signed apps App permissions granted on user installation Open market n n 17 Bad applications may show up on market Shifts focus from remote exploit to privilege escalation

Android permissions Example of permissions provided by Android n n “android. permission. INTERNET” “android. permission. READ_EXTERNAL_STORAGE “android. permission. SEND_SMS” “android. permission. BLUETOOTH” Also possible to define custom permissions 18

Android permission model 19 https: //www. owasp. org/images/3/3 e/Danelon_OWASP_EU_Tour_2013. pdf

Android permission model 20 https: //www. owasp. org/images/3/3 e/Danelon_OWASP_EU_Tour_2013. pdf

Application development process 21

Security Features Isolation n n Multi-user Linux operating system Each application normally runs as a different user Communication between applications n May share same Linux user ID w Access files from each other w May share same Linux process and Dalvik VM n Communicate through application framework w “Intents, ” based on Binder, discussed in a few slides Battery life n n 22 Developers must conserve power Applications store state so they can be stopped (to save power) and restarted – helps with Do. S

Application sandbox n Each application runs with its UID in its own Dalvik virtual machine w Provides CPU protection, memory protection w Authenticated communication protection using Unix domain sockets w Only ping, zygote (spawn another process) run as root n Applications announce permission requirement w Create a whitelist model – user grants access n Don’t interrupt user – all questions asked as install time w Inter-component communication reference monitor checks permissions 23

Exploit prevention Open source: public review, no obscurity Goals n n Prevent remote attacks, privilege escalation Secure drivers, media codecs, new and custom features Overflow prevention n Pro. Police stack protection w First on the ARM architecture n Some heap overflow protections w Chunk consolidation in DL malloc (from Open. BSD) ASLR n Avoided in initial release w Many pre-linked images for performance n 24 Later developed and contributed by Bojinov, Boneh

dlmalloc (Doug Lea) Stores meta data in band Heap consolidation attack n n Heap overflow can overwrite pointers to previous and next unconsolidated chunks Overwriting these pointers allows remote code execution Change to improve security n Check integrity of forward and backward pointers w Simply check that back-forward-back = back, f-b-f=f n 25 Increases the difficulty of heap overflow

Application development concepts Activity – one-user task n n Example: scroll through your inbox Email client comprises many activities Service – Java daemon that runs in background n Example: application that streams an mp 3 in background Intents – asynchronous messaging system n n Fire an intent to switch from one activity to another Example: email app has inbox, compose activity, viewer activity w User click on inbox entry fires an intent to the viewer activity, which then allows user to view that email Content provider n Store and share data using a relational database interface Broadcast receiver n 26 “mailboxes” for messages from other applications

Android Intents Message between components in same or different app Intent is a bundle of information, e. g. , n n action to be taken data to act on category of component to handle the intent instructions on how to launch a target activity Routing can be n n 27 Explicit: delivered only to a specific receiver Implicit: all components that have registered to receive that action will get the message

Layers of security n n 28 Each application executes as its own user identity Android middleware has reference monitor that mediates the establishment of inter-component communication (ICC) Source: Penn State group Android security paper

29 Source: Penn State group, Android security tutorial

Security issues with intents Sender of an intent can verify that the recipient has a permission by specifying a permission with the method call Senders can use explicit intents to send the message to a single component (avoiding broadcasting) Receivers have to handle malicious intents 30

Attack: Permission redelegation Definition: an application without a permission gains additional privileges through another application Example of the “confused deputy” problem 31

Permission redelegation 32 https: //www. owasp. org/images/3/3 e/Danelon_OWASP_EU_Tour_2013. pdf

Permission redelegation 33 https: //www. owasp. org/images/3/3 e/Danelon_OWASP_EU_Tour_2013. pdf

How could this happen? App w/ permissions exposes a public interface Study in 2011 n n n Examine 872 apps 320 of these (37%) have permissions and at least one type of public component Construct attacks using 15 vulnerabilities in 5 apps Reference n 34 Permission Re-Delegation: Attacks and Defenses, Adrienne Felt, Helen Wang, Alexander Moshchuk, Steven Hanna, Erika Chin, Usenix 2011

Example: power control widget Default widgets provided by Android, present on all devices Can change Wi-fi, BT, GPS, Data Sync, Screen Brightness with only one click Uses Intent to communicate the event of switching settings A malicious app without permissions can send a fake Intent to the Power Control Widget, simulating click to switch settings 35 https: //www. owasp. org/images/3/3 e/Danelon_OWASP_EU_Tour_2013. pdf

Vulnerable versions (in red) Principle of least privilege helps but is not a solution Apps with permissions need to manage security 36 https: //www. owasp. org/images/3/3 e/Danelon_OWASP_EU_Tour_2013. pdf

Java Sandbox Four complementary mechanisms n Class loader w Separate namespaces for separate class loaders w Associates protection domain with each class n Verifier and JVM run-time tests w NO unchecked casts or other type errors, NO array overflow w Preserves private, protected visibility levels n Security Manager w Called by library functions to decide if request is allowed w Uses protection domain associated with code, user policy 37

Stack Inspection Permission depends on n n Permission of calling method Permission of all methods above it on stack w Up to method that is trusted and asserts this trust method f method g method h java. io. File. Input. Stream Many details omitted here Stories: Netscape font / passwd bug; Shockwave plug-in 38

Outline Introduction n Platforms App market Threats Android security model Apple i. OS security model Windows 7, 8 Mobile security model 39

Apple i. OS 40 From: i. OS App Programming Guide

Reference i. OS Security (9. 3), May 2016 41

i. OS Application Development Apps developed in Objective-C using Apple SDK Event-handling model based on touch events Foundation and UIKit frameworks provide the key services used by all i. OS applications 42

i. OS Platform Cocoa Touch: Foundation framework, OO support for collections, file management, network operations; UIKit Media layer: supports 2 D and 3 D drawing, audio, video Core OS and Core Services: APIs for files, network, … includes SQLite, POSIX threads, UNIX sockets Kernel: based on Mach kernel like Mac OS X Implemented in C and Objective-C 43

Apple i. OS Security Device security n Prevent unauthorized use of device Data security n Protect data at rest; device may be lost or stolen Network security n Networking protocols and encryption of data in transmission App security n Secure platform foundation https: //www. apple. com/business/docs/i. OS_Security_Guide. pdf 44

App Security Runtime protection n n System resources, kernel shielded from user apps App “sandbox” prevents access to other app’s data Inter-app communication only through i. OS APIs Code generation prevented Mandatory code signing n All apps must be signed using Apple-issued certificate Application data protection n 45 Apps can leverage built-in hardware encryption

i. OS Sandbox Limit app’s access to files, preferences, network, other resources Each app has own sandbox directory Limits consequences of attacks Same privileges for each app 46

File encryption The content of a file is encrypted with a per-file key, which is wrapped with a class key and stored in a file’s metadata, which is in turn encrypted with the file system key. n n When a file is opened, its metadata is decrypted with the file system key, revealing the wrapped per-file key and a notation on which class protects it The per-file key is unwrapped with the class key, then supplied to the hardware AES engine, decrypting the file as it is read from flash memory The metadata of all files is encrypted with a random key. Since it’s stored on the device, used only for quick erased on demand. 47

“Masque Attack” i. OS app installed using enterprise/adhoc provisioning could replace genuine app installed through the App Store, if both apps have same bundle identifier This vulnerability existed because i. OS didn't enforce matching certificates for apps with the same bundle identifier 48

Comparison: i. OS vs Android App approval process n n Android apps from open app store i. OS vendor-controlled store of vetted apps Application permissions n n Android permission based on install-time manifest All i. OS apps have same set of “sandbox” privileges App programming language n n 49 Android apps written in Java; no buffer overflow… i. OS apps written in Objective-C

Comparison Unix i. OS Android x x Windows Open market Closed market x Vendor signed x Self-signed x User approval of permissions x Managed code x Native code 50 x x Windows

Comparison Unix i. OS Android x x Windows x Open market x Closed market x Vendor signed x x Self-signed x x User approval of permissions x 7 -> 8 Managed code x x Native code 51 Windows x

Mobile Web Apps 52 Mobile web app: embeds a fully functional web browser as a UI element

Java. Script Bridge Obj foo = new Object(); add. Javascript. Interface(foo, ‘f’); Java. Script 53

Java. Script Bridge f. bar(); Java. Script 54

Most significant vulnerabilities Loading untrusted web content Leaking URLs to foreign apps Exposing state changing navigation to foreign apps 55

Conclusion Overview: Platform, market, threats Android security model n n Platform security features Isolated process with separate VM Permission model App communication via intents Apple i. OS security model n n App sandbox based on file isolation File encryption Windows Mobile security model 56